trickbot | b9879d2af3dbcd380c1895d78f26e41782fd2c08c324d459a86476bfdb762f4d

Resubmissions

28/10/2021, 14:01

211028-rbt5hsbga510

12/10/2021, 19:22

211012-x2891sdbe710

Analysis

max time kernel
99s
max time network
199s
platform
windows7_x64
resource
win7v20210408
submitted
12/10/2021, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage_dropped_file.dll
Size 381KB
Sample211012-x2891sdbe7
SHA256 b9879d2af3dbcd380c1895d78f26e41782fd2c08c324d459a86476bfdb762f4d
MD5 a025bf940882b77993185b7b9abe73ab
SHA1 973f4f28d656949862e0fc0e0e0f371858aa1da7
SHA512 1cf70df6a3c6a78e7f76b8f84b1b0751a10a85042d6b3011e4debdfedbce200c19dd5c5171fe43bebe34a1978b1a0e51813a06345b698fa4298ec46d9fca0684
MD5 SHA1 SHA512

Score

10^/10

trickbot zev4 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000035

Botnet

zev4

36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ipinfo.io

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	wermgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 1724	564	regsvr32.exe	27
PID 564 wrote to memory of 1724	564	regsvr32.exe	27
PID 564 wrote to memory of 1724	564	regsvr32.exe	27
PID 564 wrote to memory of 1724	564	regsvr32.exe	27
PID 564 wrote to memory of 1724	564	regsvr32.exe	27
PID 564 wrote to memory of 1724	564	regsvr32.exe	27
PID 564 wrote to memory of 1724	564	regsvr32.exe	27
PID 1724 wrote to memory of 1636	1724	regsvr32.exe	28
PID 1724 wrote to memory of 1636	1724	regsvr32.exe	28
PID 1724 wrote to memory of 1636	1724	regsvr32.exe	28
PID 1724 wrote to memory of 1636	1724	regsvr32.exe	28
PID 1724 wrote to memory of 1636	1724	regsvr32.exe	28
PID 1724 wrote to memory of 1636	1724	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-59-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Download

memory/1636-66-0x0000000000100000-0x0000000000129000-memory.dmp

Download

memory/1636-67-0x0000000000070000-0x0000000000071000-memory.dmp

Download

memory/1724-61-0x00000000757C1000-0x00000000757C3000-memory.dmp

Download

memory/1724-62-0x00000000001B0000-0x00000000001F1000-memory.dmp

Download

memory/1724-63-0x0000000000390000-0x00000000003A1000-memory.dmp

Download

memory/1724-64-0x0000000010001000-0x0000000010003000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads